Constrain rexml version (or remove dep?)

[adsr]

Hello, given fallout from ruby/rexml#131 I think it may be a good idea to version constrain rexml to a minor version.

Separately, is rexml actually used? I don't see anything requiring it.

[mishina2228]

I was also curious to see if rexml was being used, but I suspect it is not.
#11024 was proposed, but it was eventually closed without being merged.
Related:

• Ruby 2.8.0 removes rexml gem then Gemfile or gemspec needs to add rexml gem explicitly #871
• rexml is bundled gem in Ruby 3 #899

[dazuma]

removed from dependencies